Breaking the Chain: An Attacker's Perspective on Supply Chain Vulnerabilities and Flaws
summary
Demo uploads of an impersonated VS Code extension named prettier with one t reach over 1,000 installs in 48 hours, proving marketplace spoofing and leaked tokens can weaponize developer machines. A repo‑jacking audit of 1.25M historic repos finds 37,000 repos (~3%) vulnerable to takeover. CI log scraping of Travis yields roughly 73,000 tokens from a 1% sample of logs. A timing side‑channel on npm reveals private packages by 600ms vs <100ms response differences.
AI-written summary · about
chapters (21)
- 0:00Introduction to research
- 1:33Development flow overview
- 2:21VS code extensions
- 3:38Impersonating extensions
- 5:15Extension security issues
- 6:58Extension verification flaws
- 9:06Analyzing malicious extensions
- 12:31IDE mitigation strategies
- 13:51Understanding repo jacking
- 15:30Exploiting repo jacking
- 17:22Repo jacking examples
- 18:52Repo jacking statistics
- 20:54Package planting on npm
- 23:00Dependency security tips
- 23:46Travis CI vulnerabilities
- 25:47Secret leakage in CI
- 26:56CI security mitigation
- 28:23Private package leakage
- 30:13Registry security differences
- 31:45Package leakage mitigation
- 32:24Conclusion and Q&A
related talks
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
48mHacking the software supply chain one developer at a time
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
32mHacking the OSS Supply Chain